Especially for phishing content, the requirement isn’t so much a legal one (though that’s important to watch for) as it is a practical one. People flagging phishing content on your domain can get your domain wiped from the internet. Trust me, we had a terrifying 8 hours at my day job a couple of years ago because of this.